<!DOCTYPE html>
<html lang="en-us">
  <head>

    <meta http-equiv="content-type" content="text/html; charset=utf-8">
    
<meta charset="UTF-8">
<title>Encrypt internode communications | Elasticsearch Guide [7.7] | Elastic</title>
<link rel="home" href="index.html" title="Elasticsearch Guide [7.7]">
<link rel="up" href="encrypting-internode-communications.html" title="Tutorial: Encrypting communications">
<link rel="prev" href="encrypting-communications-certificates.html" title="Generate certificates">
<link rel="next" href="encrypting-communications-hosts.html" title="Add nodes to your cluster">
<meta name="DC.type" content="Learn/Docs/Elasticsearch/Reference/7.7">
<meta name="DC.subject" content="Elasticsearch">
<meta name="DC.identifier" content="7.7">
<meta name="robots" content="noindex,nofollow">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <script src="https://cdn.optimizely.com/js/18132920325.js"></script>
    <link rel="apple-touch-icon" sizes="57x57" href="/apple-icon-57x57.png">
    <link rel="apple-touch-icon" sizes="60x60" href="/apple-icon-60x60.png">
    <link rel="apple-touch-icon" sizes="72x72" href="/apple-icon-72x72.png">
    <link rel="apple-touch-icon" sizes="76x76" href="/apple-icon-76x76.png">
    <link rel="apple-touch-icon" sizes="114x114" href="/apple-icon-114x114.png">
    <link rel="apple-touch-icon" sizes="120x120" href="/apple-icon-120x120.png">
    <link rel="apple-touch-icon" sizes="144x144" href="/apple-icon-144x144.png">
    <link rel="apple-touch-icon" sizes="152x152" href="/apple-icon-152x152.png">
    <link rel="apple-touch-icon" sizes="180x180" href="/apple-icon-180x180.png">
    <link rel="icon" type="image/png" href="/favicon-32x32.png" sizes="32x32">
    <link rel="icon" type="image/png" href="/android-chrome-192x192.png" sizes="192x192">
    <link rel="icon" type="image/png" href="/favicon-96x96.png" sizes="96x96">
    <link rel="icon" type="image/png" href="/favicon-16x16.png" sizes="16x16">
    <link rel="manifest" href="/manifest.json">
    <meta name="apple-mobile-web-app-title" content="Elastic">
    <meta name="application-name" content="Elastic">
    <meta name="msapplication-TileColor" content="#ffffff">
    <meta name="msapplication-TileImage" content="/mstile-144x144.png">
    <meta name="theme-color" content="#ffffff">
    <meta name="naver-site-verification" content="936882c1853b701b3cef3721758d80535413dbfd">
    <meta name="yandex-verification" content="d8a47e95d0972434">
    <meta name="localized" content="true">
    <meta name="st:robots" content="follow,index">
    <meta property="og:image" content="https://www.elastic.co/static/images/elastic-logo-200.png">
    <link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">
    <link rel="icon" href="/favicon.ico" type="image/x-icon">
    <link rel="apple-touch-icon-precomposed" sizes="64x64" href="/favicon_64x64_16bit.png">
    <link rel="apple-touch-icon-precomposed" sizes="32x32" href="/favicon_32x32.png">
    <link rel="apple-touch-icon-precomposed" sizes="16x16" href="/favicon_16x16.png">
    <!-- Give IE8 a fighting chance -->
    <!--[if lt IE 9]>
    <script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script>
    <script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script>
    <![endif]-->
    <link rel="stylesheet" type="text/css" href="/guide/static/styles.css">
  </head>

  <!--© 2015-2021 Elasticsearch B.V. Copying, publishing and/or distributing without written permission is strictly prohibited.-->

  <body>
    <!-- Google Tag Manager -->
    <script>dataLayer = [];</script><noscript><iframe src="//www.googletagmanager.com/ns.html?id=GTM-58RLH5" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= '//www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'script','dataLayer','GTM-58RLH5');</script>
    <!-- End Google Tag Manager -->

    <!-- Global site tag (gtag.js) - Google Analytics -->
    <script async src="https://www.googletagmanager.com/gtag/js?id=UA-12395217-16"></script>
    <script>
      window.dataLayer = window.dataLayer || [];
      function gtag(){dataLayer.push(arguments);}
      gtag('js', new Date());
      gtag('config', 'UA-12395217-16');
    </script>

    <!--BEGIN QUALTRICS WEBSITE FEEDBACK SNIPPET-->
    <script type="text/javascript">
      (function(){var g=function(e,h,f,g){
      this.get=function(a){for(var a=a+"=",c=document.cookie.split(";"),b=0,e=c.length;b<e;b++){for(var d=c[b];" "==d.charAt(0);)d=d.substring(1,d.length);if(0==d.indexOf(a))return d.substring(a.length,d.length)}return null};
      this.set=function(a,c){var b="",b=new Date;b.setTime(b.getTime()+6048E5);b="; expires="+b.toGMTString();document.cookie=a+"="+c+b+"; path=/; "};
      this.check=function(){var a=this.get(f);if(a)a=a.split(":");else if(100!=e)"v"==h&&(e=Math.random()>=e/100?0:100),a=[h,e,0],this.set(f,a.join(":"));else return!0;var c=a[1];if(100==c)return!0;switch(a[0]){case "v":return!1;case "r":return c=a[2]%Math.floor(100/c),a[2]++,this.set(f,a.join(":")),!c}return!0};
      this.go=function(){if(this.check()){var a=document.createElement("script");a.type="text/javascript";a.src=g;document.body&&document.body.appendChild(a)}};
      this.start=function(){var a=this;window.addEventListener?window.addEventListener("load",function(){a.go()},!1):window.attachEvent&&window.attachEvent("onload",function(){a.go()})}};
      try{(new g(100,"r","QSI_S_ZN_emkP0oSe9Qrn7kF","https://znemkp0ose9qrn7kf-elastic.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_emkP0oSe9Qrn7kF")).start()}catch(i){}})();
    </script><div id="ZN_emkP0oSe9Qrn7kF"><!--DO NOT REMOVE-CONTENTS PLACED HERE--></div>
    <!--END WEBSITE FEEDBACK SNIPPET-->

    <div id="elastic-nav" style="display:none;"></div>
    <script src="https://www.elastic.co/elastic-nav.js"></script>

    <!-- Subnav -->
    <div>
      <div>
        <div class="tertiary-nav d-none d-md-block">
          <div class="container">
            <div class="p-t-b-15 d-flex justify-content-between nav-container">
              <div class="breadcrum-wrapper"><span><a href="/guide/" style="font-size: 14px; font-weight: 600; color: #000;">Docs</a></span></div>
            </div>
          </div>
        </div>
      </div>
    </div>

    <div class="main-container">
      <section id="content">
        <div class="content-wrapper">

          <section id="guide" lang="en">
            <div class="container">
              <div class="row">
                <div class="col-xs-12 col-sm-8 col-md-8 guide-section">
                  <!-- start body -->
                  <div class="page_header">
<strong>IMPORTANT</strong>: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
<a href="../current/index.html">current release documentation</a>.
</div>
<div id="content">
<div class="breadcrumbs">
<span class="breadcrumb-link"><a href="index.html">Elasticsearch Guide [7.7]</a></span>
»
<span class="breadcrumb-link"><a href="secure-cluster.html">Secure a cluster</a></span>
»
<span class="breadcrumb-link"><a href="encrypting-internode-communications.html">Tutorial: Encrypting communications</a></span>
»
<span class="breadcrumb-node">Encrypt internode communications</span>
</div>
<div class="navheader">
<span class="prev">
<a href="encrypting-communications-certificates.html">« Generate certificates</a>
</span>
<span class="next">
<a href="encrypting-communications-hosts.html">Add nodes to your cluster »</a>
</span>
</div>
<div class="section xpack">
<div class="titlepage"><div><div>
<h2 class="title">
<a id="encrypting-internode"></a>Encrypt internode communications<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/x-pack/docs/en/security/securing-communications/tutorial-tls-internode.asciidoc">edit</a><a class="xpack_tag" href="/subscriptions"></a>
</h2>
</div></div></div>
<p>Now that we’ve generated a certificate authority and certificates, let’s update
the cluster to use these files.</p>
<div class="important admon">
<div class="icon"></div>
<div class="admon_content">
<p>When you enable Elasticsearch security features, unless you have a trial
license, you must use Transport Layer Security (TLS) to encrypt internode
communication. By following the steps in this tutorial tutorial, you learn how
to meet the minimum requirements to pass the
<a href="/guide/en/elasticsearch/reference/7.7/bootstrap-checks-xpack.html#bootstrap-checks-tls" class="ulink" target="_top">TLS bootstrap check</a>.</p>
</div>
</div>
<div class="olist orderedlist">
<ol class="orderedlist">
<li class="listitem">
<p>(Optional) Name the cluster.</p>
<p>For example, add the <a href="/guide/en/elasticsearch/reference/7.7/cluster.name.html" class="ulink" target="_top">cluster.name</a> setting in the
<code class="literal">ES_PATH_CONF/elasticsearch.yml</code> file:</p>
<div class="pre_wrapper lang-yaml">
<pre class="programlisting prettyprint lang-yaml">cluster.name: test-cluster</pre>
</div>
<div class="tip admon">
<div class="icon"></div>
<div class="admon_content">
<p>The <code class="literal">ES_PATH_CONF</code> environment variable contains the path for the Elasticsearch
configuration files. If you installed Elasticsearch using archive distributions (<code class="literal">zip</code> or
<code class="literal">tar.gz</code>), it defaults to <code class="literal">ES_HOME/config</code>. If you used package distributions
(Debian or RPM), it defaults to <code class="literal">/etc/elasticsearch</code>. For more information, see
<a href="/guide/en/elasticsearch/reference/7.7/settings.html" class="ulink" target="_top">Configuring Elasticsearch</a>.</p>
</div>
</div>
<p>The default cluster name is <code class="literal">elasticsearch</code>. You should choose a unique name,
however, to ensure that your nodes join the right cluster.</p>
</li>
<li class="listitem">
<p>(Optional) Name the Elasticsearch node.</p>
<p>For example, add the <a href="/guide/en/elasticsearch/reference/7.7/node.name.html" class="ulink" target="_top">node.name</a> setting in the
<code class="literal">ES_PATH_CONF/elasticsearch.yml</code> file:</p>
<div class="pre_wrapper lang-yaml">
<pre class="programlisting prettyprint lang-yaml">node.name: node-1</pre>
</div>
<p>In this tutorial, the cluster will consist of three nodes that exist on the same
machine and share the same (loopback) IP address and hostname. Therefore, we
must give each node a unique name.</p>
<p>This step is also necessary if you want to use the <code class="literal">node.name</code> value to define
the location of certificates in subsequent steps.</p>
</li>
<li class="listitem">
<p>Disable single-node discovery.</p>
<p>To enable Elasticsearch to form a multi-node cluster, use the default value for the
<code class="literal">discovery.type</code> setting. If that setting exists in your
<code class="literal">ES_PATH_CONF/elasticsearch.yml</code> file, remove it.</p>
</li>
<li class="listitem">
<p>(Optional) If you are starting the cluster for the first time, specify the
initial set of master-eligible nodes.</p>
<p>For example, add the following setting in the <code class="literal">ES_PATH_CONF/elasticsearch.yml</code>
file:</p>
<div class="pre_wrapper lang-yaml">
<pre class="programlisting prettyprint lang-yaml">cluster.initial_master_nodes: ["node-1"]</pre>
</div>
<p>If you start an Elasticsearch node without configuring this setting or any other
discovery settings, it will start up in development mode and auto-bootstrap
itself into a new cluster.</p>
<div class="tip admon">
<div class="icon"></div>
<div class="admon_content">
<p>If you are starting a cluster with multiple master-eligible nodes for the
first time, add all of those node names to the <code class="literal">cluster.initial_master_nodes</code>
setting.</p>
</div>
</div>
<p>See <a href="/guide/en/elasticsearch/reference/7.7/modules-discovery-bootstrap-cluster.html" class="ulink" target="_top">Bootstrapping a cluster</a> and
<a href="/guide/en/elasticsearch/reference/7.7/discovery-settings.html" class="ulink" target="_top">Important discovery and cluster formation settings</a>.</p>
</li>
<li class="listitem">
<p>Enable Transport Layer Security (TLS/SSL) for transport (internode)
communications.</p>
<p>For example, add the following settings in the <code class="literal">ES_PATH_CONF/elasticsearch.yml</code>
file:</p>
<div class="pre_wrapper lang-yaml">
<pre class="programlisting prettyprint lang-yaml">xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.keystore.path: certs/${node.name}.p12 <a id="CO499-1"></a><i class="conum" data-value="1"></i>
xpack.security.transport.ssl.truststore.path: certs/${node.name}.p12</pre>
</div>
<div class="calloutlist">
<table border="0" summary="Callout list">
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO499-1"><i class="conum" data-value="1"></i></a></p>
</td>
<td align="left" valign="top">
<p>If the file name for your certificate does not match the <code class="literal">node.name</code> value,
you must put the appropriate file name in the <code class="literal">elasticsearch.yml</code> file.</p>
</td>
</tr>
</table>
</div>
<div class="note admon">
<div class="icon"></div>
<div class="admon_content">
<p>The PKCS#12 keystore that is output by the <code class="literal">elasticsearch-certutil</code> can be
used as both a keystore and a truststore. If you use other tools to manage and
generate your certificates, you might have different values for these settings,
but that scenario is not covered in this tutorial.</p>
</div>
</div>
<p>For more information, see <a class="xref" href="get-started-enable-security.html" title="Enable Elasticsearch security features">Enable Elasticsearch security features</a> and
<a href="/guide/en/elasticsearch/reference/7.7/security-settings.html#transport-tls-ssl-settings" class="ulink" target="_top">Transport TLS settings</a>.</p>
</li>
<li class="listitem">
<p>Store the password for the PKCS#12 file in the Elasticsearch keystore.</p>
<p>For example, run the following commands:</p>
<div class="pre_wrapper lang-sh">
<pre class="programlisting prettyprint lang-sh">./bin/elasticsearch-keystore create <a id="CO500-1"></a><i class="conum" data-value="1"></i>
./bin/elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure_password
./bin/elasticsearch-keystore add xpack.security.transport.ssl.truststore.secure_password</pre>
</div>
<div class="calloutlist">
<table border="0" summary="Callout list">
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO500-1"><i class="conum" data-value="1"></i></a></p>
</td>
<td align="left" valign="top">
<p>If the Elasticsearch keystore already exists, this command asks whether you want to
overwrite it. You do not need to overwrite it; you can simply add settings to
your existing Elasticsearch keystore.</p>
</td>
</tr>
</table>
</div>
<p>You are prompted to supply the password that you created for the <code class="literal">node-1.p12</code>
file. We are using this file for both the transport TLS keystore and truststore,
therefore supply the same password for both of these settings.</p>
</li>
<li class="listitem">
<p><a href="/guide/en/elasticsearch/reference/7.7/starting-elasticsearch.html" class="ulink" target="_top">Start Elasticsearch</a>.</p>
<p>For example, if you installed Elasticsearch with a <code class="literal">.tar.gz</code> package, run the following
command from the Elasticsearch directory:</p>
<div class="pre_wrapper lang-sh">
<pre class="programlisting prettyprint lang-sh">./bin/elasticsearch</pre>
</div>
</li>
<li class="listitem">
<p>Create passwords for the built-in users and configure Kibana to use them.</p>
<div class="note admon">
<div class="icon"></div>
<div class="admon_content">
<p>If you already configured passwords for these users in other tutorials,
you can skip this step.</p>
</div>
</div>
<p>There are <a class="xref" href="built-in-users.html" title="Built-in users">built-in users</a> that you can use for specific
administrative purposes: <code class="literal">apm_system</code>, <code class="literal">beats_system</code>, <code class="literal">elastic</code>, <code class="literal">kibana</code>,
<code class="literal">logstash_system</code>,  and <code class="literal">remote_monitoring_user</code>.</p>
<p>Run the following command from the Elasticsearch directory:</p>
<div class="pre_wrapper lang-sh">
<pre class="programlisting prettyprint lang-sh">./bin/elasticsearch-setup-passwords interactive</pre>
</div>
<p>After you setup the password for the <code class="literal">kibana</code> built-in user,
<a class="xref" href="get-started-kibana-user.html" title="Add the built-in user to Kibana">configure Kibana to use it</a>.</p>
<p>For example, run the following commands to create the Kibana keystore and add the
<code class="literal">kibana</code> built-in user and its password in secure settings:</p>
<div class="pre_wrapper lang-sh">
<pre class="programlisting prettyprint lang-sh">./bin/kibana-keystore create
./bin/kibana-keystore add elasticsearch.username
./bin/kibana-keystore add elasticsearch.password</pre>
</div>
<p>When prompted, specify the <code class="literal">kibana</code> built-in user and its password for these
setting values.  The settings are automatically applied when you start Kibana.
To learn more, see <a href="/guide/en/kibana/7.7/secure-settings.html" class="ulink" target="_top">Secure settings</a>.</p>
</li>
<li class="listitem">
<p>Start Kibana.</p>
<p>For example, if you installed Kibana with a <code class="literal">.tar.gz</code> package, run the following
command from the Kibana  directory:</p>
<div class="pre_wrapper lang-sh">
<pre class="programlisting prettyprint lang-sh">./bin/kibana</pre>
</div>
<p>See <a href="/guide/en/kibana/7.7/start-stop.html" class="ulink" target="_top">Starting and stopping Kibana</a>.</p>
</li>
</ol>
</div>
</div>
<div class="navfooter">
<span class="prev">
<a href="encrypting-communications-certificates.html">« Generate certificates</a>
</span>
<span class="next">
<a href="encrypting-communications-hosts.html">Add nodes to your cluster »</a>
</span>
</div>
</div>

                  <!-- end body -->
                </div>
                <div class="col-xs-12 col-sm-4 col-md-4" id="right_col">
                  <div id="rtpcontainer" style="display: block;">
                    <div class="mktg-promo">
                      <h3>Most Popular</h3>
                      <ul class="icons">
                        <li class="icon-elasticsearch-white"><a href="https://www.elastic.co/webinars/getting-started-elasticsearch?baymax=default&amp;elektra=docs&amp;storm=top-video">Get Started with Elasticsearch: Video</a></li>
                        <li class="icon-kibana-white"><a href="https://www.elastic.co/webinars/getting-started-kibana?baymax=default&amp;elektra=docs&amp;storm=top-video">Intro to Kibana: Video</a></li>
                        <li class="icon-logstash-white"><a href="https://www.elastic.co/webinars/introduction-elk-stack?baymax=default&amp;elektra=docs&amp;storm=top-video">ELK for Logs &amp; Metrics: Video</a></li>
                      </ul>
                    </div>
                  </div>
                </div>
              </div>
            </div>
          </section>

        </div>


<div id="elastic-footer"></div>
<script src="https://www.elastic.co/elastic-footer.js"></script>
<!-- Footer Section end-->

      </section>
    </div>

<script src="/guide/static/jquery.js"></script>
<script type="text/javascript" src="/guide/static/docs.js"></script>
<script type="text/javascript">
  window.initial_state = {}</script>
  </body>
</html>
